Changeset 11380 for trunk/wp-includes/general-template.php

Timestamp:

05/18/2009 03:11:07 PM (17 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-includes/general-template.php (modified) (1 diff)

trunk/wp-includes/general-template.php

@@ -1470 +1470 @@
 
                 if ( comments_open() || pings_open() || $post->comment_count > 0 ) {
-                        $title = esc_attr(sprintf( $args['singletitle'], get_bloginfo('name'), $args['separator'], wp_specialchars( get_the_title() ) ));
+                        $title = esc_attr(sprintf( $args['singletitle'], get_bloginfo('name'), $args['separator'], esc_html( get_the_title() ) ));
                         $href = get_post_comments_feed_link( $post->ID );
                 }